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Abstract 



A method and apparatus are disclosed for managing a firewall. The disclosed firewall manager facilitates 
the generation of a security policy for a particular network environment, and automatically generates the 
firewall-specific configuration files from the security policy simultaneously for multiple gateways. The 
security policy is separated from the vendor-specific rule syntax and semantics and from the actual 
network topology. Thus, the security administrator can focus on designing an appropriate policy without 
worrying about firewall rule complexity, rule ordering, and other low-level configuration issues. In 
addition, the administrator can maintain a consistent policy in the presence of intranet topology changes. 
The disclosed firewall manager utilizes a model definition language (MDL) and an associated parser to 
produce an entity relationship model. A model compiler translates the entity-relationship model into the 
appropriate firewall configuration files. The entity-relationship model provides a fi-amewori^ for 
representing both the firewall-independent security policy, and the network topology. The security policy 
is expressed in terms of "roles," which are used to define network capabilities of sending and receiving 
services. A role may be assumed by different hosts or host-groups in the network. A visualization and 
debugging tool is provided to transform the firewall-specific configuration files into a graphical 
representation of the current policy on the actual topology, allowing the viability of a chosen policy to be 

evaluated. A role-group may be closed to prevent the inheritance of roles. I J 
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3I•rS^^•^i^••/ h7-f;W^"J>':?^3y7'f^jL^-V3y 

yr-()i^^mt&i:^<7)tm^^tih. y~h^ji^ii. 
mmm^ntz^^^) Y-yi,zm\-ti>. y^t'c^Y-y 

y^f-^'/h (Internet) " V-Vl 1 Oip-^ff):^ 

mi,zXr>xm\-^^tLX^j:^'^iPT H uxmm(r>B^i,zM^ 

(^ffifig-ri.) . ^-t'Xli. tcp (Transmission 
Control Protocol ) ■'^udp ( User Datagram Protocol ) 
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tcpi: LT^«$il&. 

[0 0 24] tj-juimi) li. mzm3t<nm^X'm 
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tit:^m-th. "^-^H^w? (mail-serve 

U i^— i: LT . — yU-tf-^^ ( mai 1-server ) " 
a— /Ui:, "(*lg?^—;l'-9-—>'< (internal mail-serve 
r) " ^^o-;l^$:^A-rs::i;t>#;t4>ii-S.. I*3g5^ 
— /I'Hf— ^N'^^o— yWi, ^— yP-r— y<tfOo— ;u (fft 

tp (m^^-^UiKjST-n hnyu) m^;'<-;U5r^ftf ■& 
m:fji:^mttmm^j: "sendmail (j(-JUmm) " ^i^' 

ffl) 5-Sttl#-P (5:fl^TA>ix&) . u-Mi. gfi«g 
T'^h^'NVH -^x^^ ;t^- 

hfejMTohn;Khttp) 5ifi5r^tgt::f T^h^< 

[00251 O-yUi, 3|s:«W<3{±. ( 1 ) i^^tit-^ 

=5rtg:^)?:ta^L. "whatever is not explic 
itly allowed is disallowed (B^^^lCftnT^iiT^I'^ 

•yh) tc^^^-r-S.. fi?!I;t{f, http (.'W 

h {,z x:/-9--y N-c7)i>rfD-r o-/U*sj|S ^ixX\^h^ 

[oo26]fflh;}^o v-'-jj , m\,zm 3 1 <7)pgaT'p$ffl 

t-ittH^-r i -3 tc: . x>7^ X ^ Mf^^: T/l- 3 0 0 J: 
ySr, m^<r>\?T Y^UXt^mzX^^'fMt-t 

(ilfc) m.^(r>:fim\,zxm\^hti. !^;^hh*^S(t 
S-^-r § 4-^ X h ^^yp-r (c i:,pmxhixi> (tci-^Tt 

[00 27] ^Au-jV' (um) m<r)-^y^ '/ h^-fy 



fl!l<7)-? i/— y A> 4, <?5l® (oix/^ 1^ X tcftij 1!B$ iiS ^ 
b^^m.-thZtifim.mx-h^. $i,^:(tii{f. /I'-T^ 
'f>i?'t5j:Lfr^'-fe;^$iJffiiA«. S^t^n^rh (^) 

•Tilff . y- h X >f Ji . "fm-fb ( steal thed ) " -r 

^%xhh, y-h'^x'ftc, ^N«{:is^$ix/ciitg«7) 

^Zth^t^ti.:S>i!i^. tztfL. :i<7)1jmx'l,±. y-h 
•^x-^*?, M^L<^V>T:5'-feX$:p|F-tflfiiOo-;l^$-iK 

[0 0 281 :i<r>fzibl,z. *5|Bj£7)t 3— ffitciJoV-'T 

^o-XHn-;l.:/;l— rSrSttl^ im^X^^titz) 

Izm^^X t:>iif^a-Mim7l(L^j:\,\ «iS5T- 
i> — 3£0;«(i<7):J'D— X Ho— rSrSijax 
h. i^o- XKT'^ViD— ;t— TV" 
Jft) X'h&tmitLh. u-;U^^/l^-r(i, -r^^r/Ph 

ib. "^'o-XH (closed) " Q-;HI1f{i. |5S4>ix/i 
[0 0 2 91 xvx-f ■f-f M^^-r/l^ 

zMff)^m^^^wii. -M^mcom^^m-t. E3 

{±. :tXi^'x^'bJg|fi]X>'-r-< -r •^|ig^^:-f;l^c7)#M<?) 
Pg^Sra-r, *lT|BJtcJ:St, x^-T^^x-^ra^^rx/U 
3 0 oii, yr^T-^ *-McJii:^-b=^ X i; f- '-KU 
i^-i:ifflh;KOi^'— S-a^li-Sfci^rnXv-'x:? hJglSl 

-- P$)I.V^(i:«SfcOffltg:»] (IStg) 3 15i£-^8-rS 
'•n-;l^ (role) " it'yV^^^Vn'StJ^ti^hm^^iX 
&. ^l*l^7)#Vi^->'{i, ":*:X h (host) " ^^-Xi^'x 
i5' F 3 8 0 t L-T^x/Hb^ixS . HEWtcJi. :^X h 
:tX>''x ^ h 3 8 0 J) S (r ^{i:^X h ^yP-XJi-Xi^'x ^' 
h («g$*T.7t;^Xh5}-X>''xi? h<7)«-^) 370(c:$> 
S-^i^>fL7to-/U;tXi^'x^ h 3 1 0$>l>v^{4n-/P 
X;l^-XjrX>'-x:J'h (^^^fLTtn-yl-o*-^) 3 2 
S^m^X tyKtz'^ , *Xh>J-Xvx:5'b 38 0S)I. 
V>{i:;^X hX;U-X5j-Xyx:? h 3 7 0«4o-;P:tXi^' 
x:?h3 1 0S>&».^»i:n-;UX;U-X5fXi^'x^'h3 2 

[ 0 0 3 0 1 ^ h ;Kn i^'-ti. OT«7) J: 3 tv'yHb^ 
ix&o ■T'Sr*)*,, m.i. X->-^Xi^*x j? h 34 Olc^ 
fJ^il. «-X->{4, y-f'>x-^:tXi^*x^'h3 50 
Srtn-LTJg^^it^. «-X->3i-X>''x^'h34 0{i. 
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(^rri/'x^h) 3 6 0±i:oy-h^x-f (5r:/i/x^ 
[00 3 1] mShz^-t^oiiZ^ yUx^T^^x^ 3 

1 o\±. —:>hh\^\mwL<o\fri^m (tg^) 3 1 5*- 

^^Sc 3 1 5ii. ^cOJlttS-^LT. 

flF^$ir-g>'^-b'X3 2 0^. -!?--b'X3 2 0S-^tT'r 

tlii. ■^-b'X3 2 0;^)^\ tK:tr[^^ 

tg(tg:'3) 3 1 5i:LTo-;U3 1 0*^i^br<7):^[^tc 
^^T$^^-5)>0^ A:^f^^tg (tg:ti) 3 1 5^LTbr*- 
^.o-;U3 1 0(D:fimzm^^ti^t^^7r:t. ^f-bx 
xy-f >f T-^ 3 2 0{4. 2^<r>ii^ 
— h#-^il1±. dest-port-no-range (^^fe'^tf— 

h U y ) i5 J: l/scr-port-no-range ( V — X .-^ — 

m-'<r>) a— ;U3 1 0Sr/-K>f ^h^th. 
[00 3 23 o— raiV-f-^f 7^^ 3 2 5ii. -fe 
hc7)D-yU3 1 Oti^hm^^iX^. c?-;U;5^;U-rx 
>-r>fr-^3251>. f^t^ i OI¥iMm0«-r-S) . 9 n- 

(i:. 'ec7)n-/l.;/;^-r3 2 5:;S?^'i5'a-XK (^l:-/::) 

[ 0 0 3 3 ] ^ b i/'-Ji: . OTcO J: o tc^xyHL^ 
ixh. otO. ^(i. y'->'3 4 0tc:^»i]$ix. y-h 
^x-f 350S:^LTSiS$fL-g>, ^-h^x-f 3 50 

(i. «-gsii'ri>y->'3 4otcs^'rsy-h^x>f -o- 

<scrvice-name> = 

<protocol-base> {<dest-port- 

^^'S)-!?""-t'XTi!)-S>smtp, ssh. ping, https, i5j:I/al 
^ : 

[^2] 



^:7x-X360S:{®i.. ^y-h^x-Y-Y >'5':7x- 
X360{i:. y:^:7x-X:^Xb^mi4tcJ:oT^ 
-T^WbSfL-l)) g#<OIPTHUX^i^o, V->3 4 0 

Vx-X3 6 0±coy-h»^x^ 3 5 0(2j:oT:7 >f;^ 
:$^l;>'^$i^'g>. /cfiL. <7)V->'3 4 OOrtlBiT' 

^x>f 35 0t3l^>^V^/c*^(c. y-h^x-f 3 5 0tc 

^->xy ^)V^'j>'^^fth:it\t^j:\^. y->'34 0 
^;u-r3 7 0J4. mmm\iZ{t^ ^h^z. 

X h 3 7 0 1 1 < (im— C0;J^X h 3 8 Oco^if 

fl!l£7);^;:^h^;^-7•3 7 OiicOggf^. f^i^"^. rjy^ 
^V-j^^yh (S-g-. containment) t^y^S^^i^i^sy 

(ftil. intersection) "contains (S"^) " i: 

"intersects " jlft^ct&Jfrt^, 

[0034] it^XY^fV-r3 7 Ofci:t/f:^X h 3 8 0 
D-;U:^;U-r3 2 bt^ (JlttSiJ^n-;U (attrib 
ute assumed-role) ^ifLX) T^-/^^iXh iWV^X 
^ixh) x.yy^^^>(X-hh. -:>tKl. Z^li. (n- 
;U3 1 0i:o-;U>^VU-r3 2 5 J; oT^v'/U-fb^ix 
i)) '^^a.V^^yi^V>^-:fymh^nz^-l,zVyi^'^ti 

h (m/im^ti^) mmx$>h. 

[ 0 0 3 5 ] MDL (Model Definition Language : ^y^Ji^ 
sip) 

0«4. MDLro^^A2 10^. xyT^-fT-^^fS^x 
;U3 0 0co^yx^'yx(cail?'r-&o ^y;U3 0 0{4. 
^iE-r X - :^ *f it C3 J: -> T $ ii -E) o 

[0036] ( 1 ) -t:^jLyx>f ^isarr-i./:: 

^f-bX3 2 0i4. mT<7>JgSc7)Xx-h^yhiCJ:-:> 
[SI] 



»-range>, <src-pK3rt-no-range>]. 
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SERVICES { 
smtp 
ssh = 
jriag = 
https = 
all_tcp = 



TCP [25] 
TCP [22] 
rCMP [8,0] 
TCP [443] 
TCP {♦] 



-9--h'>?.{i:. -^--t'^iZ/U-r. -r^i^*>. ServiceGrp 



} 



<srv-grp-iiame> = (<servicc-iiamel>, <service-name2> . . } 



10037] aT(^^-\^yy:/^yhli. 2r>co^- 
b'X^;^— -t^h-h. admin-to-gtwy (y—h^j:. 
^t^^f^mY—y) gtwy-to-admin d^V'— Vt^?^ 

] 

SERVlCE_GROLFPS ( 

adniin-to-gtwy = {ssh, png) 
gtwy-to-admin — {ssh, https} 



[0038] D-;U3 1 Oti. aTcOj^coj^'r-h^ 

role-grp-name (o— 
7-^) ii. l:^T^;K>r VhL. ser-grp-name (1f-b';^ 
i/;U-r*) (i. ^?--b'X:/;U-r3 3 0^.-i^>f>'^■r 
l> : 

[ifc5] 



<role-name> arrow <role(-grp)-naine> : <srv-grp-name> 
arrow = ^ 1 1 -> 1 1 <-> 



[0039] aTcr>z2-]<yy^;<yhl±. ±Mcoa- 
'i'^h'h. mail .server ^interna 
1 .mail .server i:^^'^'^. gatew 

ay-in h^a:-^ - ^ y) ^-Sn— yUh. gateway-o 

^ y^y jL-^^co^-^mz^iir^mti mm) ^=e'r 

Mt-th. Zjx^<7)Zk^mT<^^-}^yy^^;^yhi,z 
me] 

ROLE_DEFINmONS { 

mflil_sciver o * : smtp 
intenial_inail_8eiver mail_Berver : smtp 
gatewayjn ^ fw admin ; admin_to_gt\yy 
gatcway_out £w_adJiiin : gtwy_to_adiiun 
intranetjnachine all_tcp : ♦ 

\ 



[0040] u-/^3 1 0(i. aTcox'r-h:<yhlz 
SiZ^JU-T^t-^tl^ : 

mi] 



<rolei-grp-name> ~ { <roIe-riainel>^ <role-name2> . . . } 



[0 04 1] o-;l'3 1 OJi. \:XT<^X'r-h^yhlz 



X9u-XY^-)Vy)V-y''3 2 S\,Z^)V~y^\L^iL 
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<role-grp*narrie> = « <role-namel>, <role-name2> ... » 



[004 2] mTt7)r3-K7^^^yhii:. n-;U;/;U 
ROLE^GROUPS { 



hfltz) "steal thing {%mit) " 



gateway = «gaiewayjn, gateway_out» # a closed group 
[004 3] (2) fflh;i^ni/-cofB^Ei5j:^/-fe^jL>J b 3 8 0:fe JiIXtJ^X hir;U-T3 7 OJi, tJlT^O;^ 

IS) [SCIO] 

<host-iiame> = [ <IP-Addr>3 : <role-grp-name> 

<host-grp-^^ame> = [ <IP-Raiige>] : <role-grp-iiame> 



[0 0 44] WF<r)^-Yy'7ifp^>h\t. ^^^Vi^ 
y-'r^ (dirty) ( S ^> < h y b ^ b cOJ^Hil ) 
r:^"!-^ (dusty) ^c^HL. Clix/otc. 

HOST{ 



mi 1] 



dirty = [ 111.222. 100.6 ] : inail_server 

dusty = [ 111.222. 1-3] : mtemai_mafl_server 



<gateway-naiiie> == { <host-namel>, <host-name2> ... } 



[0 0 4 5] mTcOn-b7^^.Xyb(i. payroll_gw 
_interfacel/2^7^>?. b t LX^mL. -^il^^^OIP-T K 
l^ASrfg^U. payroll_gw^^y'-b^x^Sr. 
S#<7)2OC0-f y^':7x— tT. payroll_gw_inter 
HOST { 



[iii 3] 



payroll jgw_intcr{acel = [11 1JZ22.26.226 J .gateway 
p^oll _^_mterfece2 [111.222.24.210] : gateway 



GATEWAYS ( 

payroll { payroU_gw_intcifec6l, payroll jgw_Lnterface2) 

} 



y->'34 0ii. UlTcoX'r-h^iyhl^zX'oX&m^ mi 4] 
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<zone*name> { <gtwy-interfac0-narael>, <gtwy-mterfece- 

nainc2> ... ) 

[0046] WTOn— K7^:/^>h(i:, B^iZ^ on_2oneii:payron_gwJnterfaceltCj: oTpayroll_gw 

yhy^--/ hmanhattan.officecT)— a5T'$>^ ) payr ifZm^^tl. payroll _0*)C7)|gi:c7>>f 7 x— Xlicorp 

HOST-GROUPS ( 

nianhattan_ofl5ce«tm -222.0.0-1 11.222.255.255] : mtrBnet_mBchinc 

payroU_20Qe - [1 11.222.26.0-1 1 1.222.26^55} ; payroll_inachiDe 

corp_zafte =[111.222.24.0-111.222.24.255} : 

non_payroU_m&chine 

1 

ZONES { 

payn^_rone = { payroll jgw_iiUerfacel} 

coip_zone « { payroll _jgw_interfacc2, . . . ) 



} 

C004 7] ^y'JUayj^^t y 

ItM imf) ^tl. MDL (^T^/U^STO) 2 1 0 

^>im\?h't'f)V3 0 0^^^LfzmifZ. x>T-.rT->fM 
f^^x;^3 0 0{i. ^x;uaw\M^24 0tci-pT. 
^ 7 T r ^ :r -yi^n y :7 ^ ^ 1/ - 3 > 7 r ^ 

;P2 5 0ti^l^;?fL-i). CiO^lf^ii:. ^^hLTtfO^r 

r?' 7 x — ;^(::*t^-^ u v-^ ^ 3 V7 r ^ ;U€r 
n WnM 7 24 Oc7)>'N'-y:?'x>'H(i. 
7 >f ^ TS) ^ C: i: ix ^ . 

[0 04 8] ^-trxi3j:U^7^xbi/;^-rtim--l>r? 
>'7^=af^L._c^3>.:7 7.>f;^2 5 0(i:. 

w(3^HJO-®7 r T'^ :r U ;^ h 5: 

h {W&^h) o ^cO-^Sij7:r-^'y OTO 
7-^— '^'5r:b'ip. sorce host-group (V— 

h^;P— 7') , destination host-group 

yl^— 7°) . service/service-group b'X/'*?'— b' 

X:/yl~7°) . action (i&ft) (i5lJ;L(f . pass/drop 

(iiiS/ffii^) ) . *5j:lXdirection C^ffi]) ^-^O. 
:^r^7 >f — /l-Kii, ±3*Oo— ;Ua:vx>rx^ 3 1 0(?) 
-}51^m^t\±m^j:h^h\iZ&m:th. ^^dry Vipy ^ }V 

-:>3tB^;irT\ ?tJEt--l»iSf^ (action) i^^mi^tlh . V 



10 0 49] —:><7)mmmf^zi6\^^Xii. 7r^r^^- 

^co^^(,Zji-{-fXff^t>tL^ o ^-r^l^n ^M 7 2 4 0 
[2l4*5j;I/ll5C3^f idt::. (m*) :7T-f 
r^^— V7 >f ^j2.l/— S/H >'7T^;U250A$: 
±m'^fzisbcom:^'^^lU^y^^y^ 4 1 0&{i;t^. 
Ja;tT. ^'r;^3>'yNM7 24 0«i:. ^tl^^ti. ^-h 

^x>f-f v:5^7x-xi 20. 1 5 0(ciS-& (r^^r 
h) $ii-g>>'N'^^y h7 >f;u^i;y:/n>'7 
3>^7r'</H 25. 1 5 5S:^^-r^7'cd6(7)3J>'7>< 
^^U"i^3 y7r>f ;l^h7Kni;-r:^r:5^4 2 0$:fii 

[00 5 0] S:*:^-r;l^3>'>'\M 74 1 Oii. xvt" 
'r>fMiI ( y >'>'vr) ^'ryU3 0 0co-f v;^ 

^yXS-. 7r-fr^^-/P3>'7^^jLlx->-H>'7 

r-f;l/2 5 OAtc^lR-tSo S*^Tyl-3 yysM 74 1 
Oii. Si7)ttit^ fifiJiif. y-h^x>fco{i^(ite^gL 
X. n-;U3 1 0. u-yUi^/P-7'3 2 5 

x/zix^(Dn'^:^h^ju-y3 7 o^cowmxiz^±t 

S*^T;P3>'yNM74 1 0«. a-jU3lOtsX 
Xh:^;U-7'3 7 0*-'^il4>coraT^T^i:>fl*#^c7)-9- 
Sr. tW-h^x>fl 20. 1 5 0*>'|||g(3C:c7)^IiJ 

X. mmmzmm-h. m^^'f)vuyj^^ 74 1 oc?) 

:t— ;Un>'7 ^=^a.U— v-s ^7 r>f;U250Ai:^ 
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[00 5 1 ] o-;i. (fftgij) <D^m\t. p=5rS6f^ 
h^S(*L. ^ix^-b-y hc7)S|giM. HhB9jI-r-l>tm 

[00 53] ::c7)pgMti. S^^x/i-n v^nm ^4 i o 

h ^}V-y'ifi n - X K r 5r f J S 7^ 

mz^ S*^r;l.=7WNM^4 1 0;!?^ ;^Xb:?^;l/-r 
HSr. hSrK^<|nl— ^7);^::^^^?^;^~ :7-;^^^fi£^H' tCT 

-r/Pn W\M ^4 1 0(i. ( HT'{i:=5r<) H ' t rajSi" 

ii. :^—^^'^Wj:^^7^V1f}V—y (non user-defined 
host-groups) O^tixVN'-y^y^'jiig?: i OHIft^ 

[0 0 54] Z<^fz^{Z^ ■:¥Wtmz^\'^X\t. X^WS^ 

Cc, ^'D-XFn-;P^;l~rS:J&57Ki/'f*'<X 
6^) ^MifJ;^^ ::xvy ^^:L\y—^^B'yyrA)Vnx\ 

^«MiJ^Of*Cc . " ^c7);^X b ^^VU-Xicit LT(itg^$ 
iX^ tcOtJy'MirF^r^iX^l^ (nothing else is allowe 
d for the host group) " ^SSfct^Sri^-O^t-^'T- >f X 



-/UXyU-Xc7);^S:ffi3^'ja. :^TO:J^d-XKo- 

-g). 7^-:^hXyl^-Xii. -e<7);i^X hX;U— Xtc^D— X 
Kn-/UX/l— X;^?^SiJST'bfLTl^^J©'g-ii. ^n-X 

[00 5 5] I16(i. S*^x;UnWNM^4 1 0(3j: 
->rimT$il^-^h LTc7)SfJ^r;l'r/>JXA6 0 

OOa. 3o^3ag*^^«fig.$n.. ^i7>iii^^^i^TL.;t 
^^X\ "fy^JVV (^B&B$) ayA^Hn-^i'jr (?«fi5W) 

^;U2 5 0tijDi.^ii^. 

[00 5 6] gWc. 3aglcOX-r-yr6 1 0\iZ^\^ 
X. ^n-XV&^y.h^Ji^-yco^TlznLX. ZtL 

^com<^^x<7)7fti^^^y mmm ^j:mnw^^ix 

^<^m. Xx'yX6 2 0(Ci:3l^TaS^lT^^fi 
fz^'Ji- >f y'^jimWW^^y T^T^yt-JUayy 
^b—v-a >'7r-f;U2 SOAtcifA^ii^. 
[00 5 7] mz. i^g2i7)AT'^yX6 3 0(Ci3V^T. 

^D-XK imttiymm ;i^xhX;i'-xHih. :t 
-xy (^v^/::/^iSc) ^^xhXy^-XHgCO^^rtc 

MLT. ^ix^^oraco^T^.-Ki/'x^X^r^MfW-'^^^ 
tLi»o ;^x^yX64 0(Zi^V^T. X^T^Xh 

X;P-7-H 2 ^2-^ ^ iX ^ :^ D - X K 7^ X h X/l^-X 
Gic^^fLT. H,i;G^orao^TO^^;<rT'-rX (m^i 

W)) ^mnw^^tih. ^<r>m. x7^'yX6 5otciD 

2(7)7^^7" r^j:mnw^^y r -i r^^r-yl-r? y 7 >f 
^':2,U-i^Byyr^ )\^23 0A{znX^fth. 
[00 58] mz. 3ag3cOXx^yX6 6 0 (116 B) 
(ci5l^T. «-:^o-XK7^XfX;^-XH(cS:tLT. H 
hall-hosts (:t— ;p7t:Xh) ^-^ifvX hX/l^— Xi:^^ 
racO;t^;<fx>fX^«IiJ;&^'^$ix-S,. ^cof^. Xr^yX 
6 7 0(^i>V^T. ^^ixtz^-:^''r4rtpMWW^^y 
r^T'^ir—JVayy ^ zlI^—I^ B>y r ^ )V2 5 0 
A(c^fA^fL^, mz^ X-r'yX6 8 0^ci3V^T. 

7•y7^x h xyi~X(7):g.^r tew lt . ci^t a>(7)^(7)^ 

TO.-Ki^'^^X^Sr^giJ^^^-'^^ixS. mz. XX-/X6 
9 0t::iDV^T. ^ixf^>.i^>'x^X=5r«fJ>^?^4'5^7r>f r 
ymv^ ^^^l^-i^s y7r^;U2 5 0 Atcf? 
A$fi. XnX^ASiJWi^^T'T'l). 

[00 59] «Bij^ryu=f t;xA6 0 ocom^mnt 

LT, ^T^*XhX;U-7'Hi tHjtitLT. Hit 
MjIL. H2(ct>iaffl'r'l)^^^x^X^^iJ<7)U 

ia7t3^^J;3(i. ^iX^.7K£^'x>f X^^IOfi:. lUT^O 
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servicers 



for each role r in the role-group assigned to Hi: 

for each siatemcnt in the forrn: { r $ R : 5] 

if H2 is closed: /* create a rule if Hi has a rdc, r 

if the role-group assigned to H2 contains a role in R, then 
create a positive rule between Hi and Hj vnih 

otherwise, for all host-groups G that contain Hj: 

if the rolc^group asslgued to G contains a role in R 

create positive rule between Hi and Ha with fiervice=^ 
where r is a folc, $ tnAcatcs the direction, R is a role-group and & is a 



service. 



X : 

o-;l/ S:^* /H2 (^zwm hfifz n -)V^)\^-y^m^i,z 
Sr. sevice=st3^^ LT. i^fefiE 

nLx '^i,zm^^^ixfzu-})^^jv-y'ifiKn\fZVi2^'^ 

[0060] rV:^X h i/;U-rH*>'^ O-X H:^ 

t^o^ffl^L. n-;U:/;l~rci:Rii. ftffi 

^7)n-;Wi:!^;t^v^ (IgW^-iKf. "R^R : s 1 " ^ 

^^\t . 31I(±«r;^::/ 'J 6 0 0 c7)ig|^ 3 (7);^:;J?^M 

SOSr^fiScL. ^V^T. HtH* <n^r\izn^hifsV'f^ 

[00 6 1 ] JiMiOctotc, S*^-ry^r3WNM ^4 1 
0 J; o T ^ ^ ii/:: 4^5^ r r ^ ^ -/L- 3 V :7 ^ ^ 
a-l^->'3>'7r^/l-2 5 0Ati:. ^1 OOl^cO^&y- 
h^x'< 1 20. 1 5 0(1. ^-y-h^j^-^-f >'^7x 



-X 1 2 5 . 1 5 5(-^^'fL$ix^cm\ ie^'r'g>'£^ 
hfz>h\^z\t. ^X<r>y-V^ =uAna^^tLt^am^^X 

i7) nJtg^;U--r- >f y T<^^r<7);i;;?. h (egg 
h . ;u~r >r Vr^^ru h uMzm \.X<n^*^^Wi^h Zi 

h^mmthfz^. iJiv. )v-'r^>^(^^mzn'^ 

4'*7r^T^=r— /l-n^^ ^^ji-U— £^3 >'7r 
-<;^2 5 0A7!;^'#y-b^x-r 1 2 0. 1 5 0±(C?S^ 

[0062] ±3*cOj;-5tc:. uv^ ^ =¥'^2.1^— S^a 
T-f;U'h.-Kni/-r:^r^4 2 0«. «giJ^7)^r[Si7 ^ - 
/UKSr-fe-yh (1^^)^^. 7T-f T^:t-;Ni:. :firrS] 

^-/Ni. yt^v h^'y-h^x>f ^ :^:^7x-xi 2 
5. 1 5 5(CA^:^f^^^x'y^L. ^<r>-n^-i:. «I0 

s.-:^t^hW&^r->^z^l>^h'kWi^X\'^h 
^(r»^^yY\t. ^<r>m^<r>-n^tK IN (A 

w\coij\t]ti<. OUT (aii>) hh^^imn mu) izm^ 

^tlX^^^i^CO^IfZ^^^^tl^b . 
[0063] :/7ffi]7>f-/l-K(i. n-;KaSiJ) i7):^ffi] 
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[0 0 64] — ^Rfflh^J^oi^'-t^tJViTJi. /U-T--^^- 

=^jL U-v- 3 ^-7 r ^ yUh^^ai^'-TrJ^T:? 4 2 0 {i, 
0St;^-ri3^7';uaf'JXA8OOS:|g3S-r-l>. 08 

iKlC. T;U:/UXA8 0 Oti. ^■y-h'^x'f -Y y 

if the source is in the luljscent zone 

set direction to OUT 
else if the destination is in the aiijacent jzone 

set direction to IN 
else set direction to BOTH. 

'^^mzwc^ 

^<^^(r>^\t. :fe-|*]$:BOTHtciS^ 

[0065] ymtc^im^^n'm-htz^. ajix/xy- 

y < y^^^}tt^fziib{,z{i. oy^mzmt 

'r^-7^-^P^\,zmi.h:Lhi>^ x:^-r-f -r ^BSf^^rr^l' 
3 0 0^<7)X:7Xt>'>-3 gpt Lxm'fhZtij 

[0066] mm-i 7^ h I — ^±^0 i dtc. m.'MAt 

/•ryN' y y^>y-yk2 6 0 {±, 7 r ^ T'> ^r-yl^n > 
7-<dfi^— i^g>'7r-<;U2505:, r 

b) (r>mi;<r>m%mm^w^^h mnmzn^-t) y=y 

ymi^Z^m-h . ^^^/iri^-^^VCrv-lVT. 6 0 

:^'ft;/''r''<v^i^^'y-;U2 6 0{±. t'iO:^^?, h^^/U- 
^W-h'^x^ VrJ'^x-;^ l 2 5 ) , 15 5(7)if 
*.4>(IOtc<3iS-r-i.*\ *5j;V-e-coy'-h'>x'f^>':J'7 
x-XtioTMS (ll=ff) $iil)7r'f r"^*-/!^ 

[0067] WM.'}C/'f/<^v^vyv-)V1 6 Oti. 7 



r ^ T'> * -/PV >'^'2 0 0l,zXh'f''^'y=^y^:f 
:^9i:mz^h, i]=yy)Vts:yyy^%h-^i/^. *V^g 

mmz±:^^Mz. mm^yr^T^yt-ji-y^—?--/ 

h(cj:|>3y7-f ^iU— >-g>'7r-f/l'$-, WlStc^- 

JtfiL, S^-fl:/T>'N'-y=Jf>-^^"y-yU2 6 0»i:. ^ixe 
*T-t. ^gET'ft^. m«'fb/xv<-y=sf>'^^>y 
— /U260{±, 7t-^ r-^*— ;W=iy7 -f^jLl^— v-a 
V7r'f;U2 5 0?r^i6^Jtttlc, ^Slt-ft/x-'N'-y^y 
:/>y-yl'2 6 0^ffl\.^T, 31:if-r-l.3>'7-f 
3 >'7 7 ^ jUi V^<—x:iiy'J=.TL. -fe^ J. U X ^ *• 

[0068] Uni\:yy'^<-y^yi^y-fl-2 6 0(4, 7^ 

containment) 'f>':J'-fe:?i^3> ('^^ji/ft 
intersection) t V^'5ta^.(C^ftT«:^'fk-r 

zini. hh^^:^hi^ji^yAi,zmm-thmMM. 

^tii>t:MzmWTSii>, 

[0069] h^;U-7-<7)1«jt(4. H**-?- 
co*x h ^;U-7°<7)^fJtcT 7< U yy^ti:^^^ 7 1 

y-HAt Bt(?)iai;0±<||V^j:-yi'\ 0!l;t{^. ilS9 1 

0. A B*>B A*»«i:) , i:'^^>iOy-K*^±T-*^ 
*Hc;<t-:>TS^$ilS. ^com^x-yv-', 0iJ;Hf. 119 
3 0, 9 4 0(4, -iy^-k^h (intersect, ^^31^ 
'k)X'hh imm-tixif. WS-t-l.*^ fztzL. --liifi 

[0070] mntfz. b^;p-r{4, ^tLt^ifiwrn. 

■Ti.-^ >:J'7x-X<7)-9--f HlcioT, 2-PCO?&T-d'y 
9 5 0, 9 6 0(I^fiJSil^. — :^<?D;{?-r:?"'J{4, "^'l- 
ffi!l (outside" v-^-gsoiiuftm, ::ix«4, ftSW 
tc{4, -f>'^'-^-y hV-:^! 1 0 Sr-^tj:frT'* D , ffi 
^i?>X?-r^'JJ4, "l^lfflfl (inside) " V— >'9 6 0fcD? 

[007 1 ] :}i-SiJ$ix:^^«i5:«:a'ft;-ri.^c*^t:{4, _ou 
t±><l:l/_intiif{fix§2-:3(?DAPW'5: {T-^<y^ 
i^-v;u:Sr) *;^h^;k-r9 7 0, 980A<^A$ii, 
^^77 9 0 0<?D4^*(c, 2r>(r>'Sr'i^m^<r)y 
-h'9 7 0, 980i; LT«^SixS (ffiO^fx;^ h^J^/l' 
-7-{4IIRi: LT*$il§) . h:/;U-7°9 6 

0{4, _iny-h'9 8 0*><i>T[«iIlc«ft-r-S>7Ki: LT^ 
S^^ix, i'Hffl*Xh:/;l'-7'9 5 0J4, _outy— H9 
7 0ti-h±.mz^m-hi!^tLXm^^tth. ZoL 
T, rtfD*;^hir;l^ r9 6 0lCOV>T{4, A{4x-y£/' 
B'VCOS-i- (>f y^'yU-^g >, inclusion) X-yi/S: 
A*<BJ:0±T'fc-l. (A<50::^*J_iny-H9 8 0 
(^jSV^) :^^t4, A B(7)raf^*^fiS:i5i:-P<, J'HI5;^.;!.h 
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i?^V^-r9 5 0t3Ol^Tti:. _outy- H 9 7 0Hi5V^ 
^<n^)V-nf^ ms'k^'^-th. *9 5 0 . 9 6 0 
^<D^1^9'0 — i/^ (;^/J^I?^. transitive closu 

re) if. i)r^7.v<r}v-y^(7y^%mmzm\^\^m^^^m 

y950h. "f^ffl!!" r-y9 6 0(cm-r^ii^ii:. ^ 

iznt^mwico^^mkL. mi3(DJiy}^ytt-(>'h'¥y 

-b'X^8l3«IfJ{i*l«'r^. I19t3^^i3t3. 

:^-/zyi^-Ymz^m'th:f7y-\fZX 
oT^Six^. ^Jx(f. :^T^tcp-^-b'xii. ^.CD^ 
mzXr>Xm^tl. ^T^7)telnet-t^-b';:?.{i;. #^.^^91 

[0073] ]PXL. *%BJ<?o«>^=Sr^Sfefi?iJi5iC</N'y J- 
-i/HVtcoi^TlftBBLfci^^ ::ix^?>(i. mz. ^^hj 

[00 74] ^t;^^7)71/'-/.V-;5^ (^$^ffl) 

^)\^ mm) \izmm-h^t^j:<. ^<mz^j:^r'jaL 
[HI ] ^^mi^zxh-mt LTcopoiSii^^t- 

[122] mi(Dyr^T^i:-)V-?A^-'J^<^mn^m 

[US] I12<7)X>T'^T'>f (Ul^-i^aV^'^y 
[114] m2(DK.yy;^^i^y ^ 9tc^y^Uy(n^ 
[[15] mA(r>Kyry.^i^y y^tcziyj^'y^ilzX 
::iyy >i ^ jlV-i^ B yy r ^ )V<D±^^^-tWxmx 



(1216 A] — i*i:=5:oTs 04c7)a*:^'ryU3 ^ 
\iZi:->XWi7^fih-mtLXo^m\ 

[(16 B] — fr^^oT. 04<?^S*^x;^r7>'/NM ^ 

[117] meAi6i.ifmeBa^mm^^T)\^^^)XMz 
{ms]mm^T}v-[^)XMzii-:^x^-^tifzmm 

fiRIi: LX<r»V-^yi:9ri'tmxhh. 
31$':^'rilT'S)l>. 

[?$-^^oBi0^] 

100 m(7mm 

110 ^y^-:^^-/h 

120 ^hSP^T-fr^^r-zKESiAc^) 

130 -t^— >'\V— >- 

134 DNSH?-— >'N' 

13 8 v;U^7Vl^'9--yN' 

140 ^r-^r^^^r-yp^y-i^ 

1 25. 1 55 ^^1rvhy^)\^^')y^ziyy^^^ 

v-zy syyr^iv { ^^tr -jvy ^ )V9 V y^MWl^— 

xy—h^ ^ yi$^ y 3L—X) 

160 ±^^/-y 

150 rtSP7T-f r^^-;u 

2 0 0 7r-f T^^-ZU"?^-— 
2 10 (MDL) 

2 20 yN'--*^ (|?;pf?S) 

24 0 ^r-r/t-u^yxM 7 (^>':$^x^v'7 ^J' 3 v 
7 ) 

2 50 y r^T^y ^—)i-':iyy jLU—i^ 3 yyr 

2 60 mmtx^^^^-y^yify-ji^ 

300 XVir^f ( 'Jl^-v-gyv-'yT) =t'f 

)V 

3 10 n^/KagiJ) >ry£/x:^h 
3 1 5 fg^ mm 

3 20 -^--b'X 

3 3 0 ^?--b'X:/;W-7' 

3 2 5 n-;^:/;P-r^rv^x :^ h 

34 0 V-yitX-Ja.'^V 

3 50 ^^'-b^x^:ty>''x^ h 

3 60 y-h^x>f ViS^^x-^^rt^i^'x:? h 

3 70 ir^XVir)V-r:^X-J:L'PY 
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38 0 TjtXhjj-yi/x^' h 
410 SsJs^x/UnWN*^-^ 



420 vyy ^^j,U—i^3>'yT'<)Uh:t^x:> 



[an 



[112] 




210—- 



(MDL) 



300- 




240 




250- 



360 — 



—370 



stents 



—325 



330 



[113] 



-340 



-310 



-350 



—380 



-h —315 



tr7 



240- 



410^ 



420- 



[114] 



—320 
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im5] 



[06 A} 



300- 



410- 



600 



25aA — 



420- 



125 



610^ izt^Lz. cnerop^oo^r© 



620-^ ||>7<=¥ab-i/3>7M ^ ^ 



155 



630 — 



-f>^7l-7N 



I 



640 



«Lx.Hi tGi:a)Wa>±r(D*j!J 



[EI6B] 



660 — 



1 



H6A 

tr6 



^aU-i/a>77-fJUZ}iArS 



670- 



U-*>3V77'f^U:J¥AtS 



680-- 



I 



690 — I u_$^>7y<jWr|fA^S 



J 



[07] 

for 9ach rode r tn the rals-^Dup asslgnad to : 
for eacti Btatemont In Uve fomr {r$R:^ 

r where r Is a rtrie, I Indicates the direcfion, R ts a rols- 

gmp and » is a serv^ V 

If Is dosed: /* create a aile If Hj Kaa a role, r V 

IT the rotfr-group asstgned to oortdns a lole tn R, 
then, 

create a po&tUve nUe tietween and wUh 
«ervlos = e 
othervtftefi, for en host-9DupeG0\at contain 

ffth6 rtf«-g roup aaatgned ta G contains a rds In R 
cmate poelttve mla between H, and Hj with 
88rvtoe«s 

H.tH.i:©P5WiI?>*-5"'^ ^ieSl*'. aevioe^ tCWUT. ^ 
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[08] 

800 

\ 

RDpIIceto the oentrslizod oonflguretlon file to every gateway 
Interface 

tor each O8l0way intarteoe 

for each rule In Ois oonflBuraOon lite 

if the souroe ta h the eiQaoerd zone 

set dlretOon to OUT 
else tr the destfretkm te In the atUaoent zona 

Get direction to IN 
else set direction to BOTH 

jw •> I -f Y > ^ 7 x-X tC LT 
;6rfR3€ OUT tCi93£ 

IN tzas3£ 

[119] 




(51) Int. Cl. 7 

H 0 4 L 12/26 
12/66 



F I 
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(72)^0fl* TU^y i^j^UJX ^-f^- 

rP<'J*-^ffl 10017 -jL-H-^, 



^•^'^^ 45 



